A method for identifying problems in a network environment, comprising the steps of: 

a. during more than one interval determining the level of one or more-impairments; 

b. grouping said levels of one or more impairments into one or more event groups; 

c. comparing said one or more event groups with one or more problem signatures; 
and 

d. categorizing at least one of said one or more event groups as being associated 
with a network problem having one of said one or more problem signatures. 

A method as defined in Claim 1 5 further comprising the steps of: 

a. determining the source of more than one call; 

b. grouping said more than one calls into one or more call groups based on the 
source of said more than one calls; 

c. for each call group determining the number of calls having said network problem; 
and 

d. estimating the location of said network problem based on the number of calls 
having said network problem. 

A method as defined in Claim 2, wherein determining the source of more than one call 
includes determining the source internet protocol address of said more than one call. 

A method as defined in Claim 2, wherein estimating the location of said network problem 
includes: 

a. determining the percentage of calls within said call group having said network 
problem; and 

b. estimating that the location of said network problem is equal to the source 
associated with said call group if the percentage of calls is high. 

A method as defined in Claim 1, wherein said one or more impairments is selected from 
the group consisting of delay, packet loss, jitter, distortion, absolute packet delay 
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variation, relative packet to packet delay variation, short term delay variation, short term 
average delay, timing drift, packet loss, and proportion of out-of-sequence packets. 

6. A method as defined in Claim 1, wherein said network problem is selected from the 
group consisting of local area network congestion, access link congestion, route change, 
access link failure, route flapping, load sharing, and route diversity. 

7. A method as defined in Claim 5, wherein said network problem is selected from the 
group consisting of local area network congestion, access link congestion, route change, 
access link failure, route flapping, load sharing, and route diversity. 

8. A method as defined in Claim 7, further comprising the steps of: 

a. determining the source of more than one call; 

b. grouping said more than one calls into one or more call groups based on the 
source of said more than one calls; 

c. for each call group determining the number of calls having said network problem; 
and 

d. estimating the location of said network problem based on the number of calls 
having said network problem. 

9. A method as defined in Claim 8, wherein determining the source of more than one call 
includes determining the source internet protocol address of said more than one call. 

10. A method as defined in Claim 8, wherein estimating the location of said network problem 
includes: 

a. determining the percentage of calls within said call group having said network 
problem; and 

b. estimating that the location of said network problem is equal to the source 
associated with said call group if the percentage of calls is high. 
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11. A method as defined in Claim 7, further comprising the step of producing an array of said 
levels of one or more impairments from measurements taken at one location within the 
network. 



12. A method as defined in Claim 11, further comprising the steps of: 

a. determining the source of more than one call; 

b. grouping said more than one calls into one or more call groups based on the 
source of said more than one calls; 

c. for each call group determining the number of calls having said network problem; 
and 

d. estimating the location of said network problem based on the number of calls 
having said network problem. 

13. A method as defined in Claim 12, wherein determining the source of more than one call 
includes determining the source internet protocol address of said more than one call. 

14. A method as defined in Claim 12 5 wherein estimating the location of said network 
problem includes: 

a. determining the percentage of calls within said call group having said network 
problem; and 

b. estimating that the location of said network problem is equal to the source 
associated with said call group if the percentage of calls is high. 

15. A method as defined in Claim 7, wherein determining the level of one or more 
impairments includes: 

a. applying a local timestamp to a packet corresponding to the actual arrival time of 
said packet; 

b. extracting a sending timestamp from said packet; 

c. extracting a sending sequence number from said packet; 

d. estimating an expected arrival time for said packet: and 
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e. subtracting the actual arrival time of said packet from the expected arrival time of 
said packet. 

16. A method as defined in Claim 15, wherein determining the level of one or more 
impairments further includes computing an average of said subtracted value over a short 
period of time. 

1 7. A method as defined in Claim 1 5, wherein said one or more problem signatures includes: 

a. a high value of short term delay variation without an increase in delay; 

b. an increase in delay accompanied by an increase in short term delay variation 
followed by a decrease in delay; or 

c. an increase or decrease in delay accompanied by a substantially constant level of 
short term delay variation. 

18. A method as defined in Claim 15, wherein comparing said one or more event groups with 
one or more problem signatures includes: 

a. comparing a change in delay during an interval with a threshold; 

b. determining the level of said short term delay variation during said interval; and 

c. determining whether a preceding interval contains a delay impairment. 

19. A method as defined in Claim 18, wherein categorizing at least one of said one or more 
event groups includes: 

a. when said change in delay exceeds said threshold and said preceding interval 
contains said delay impairment, categorizing said event group as said access link 
congestion. 

20. A method as defined in Claim 18, wherein categorizing at least one of said one or more 
event groups includes: 

a. when said change in delay does not exceed said threshold, said preceding interval 
contains a delay impairment, and said level of short term delay variation is low, 
categorizing said event group as said route change. 
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21. A method as defined in Claim 18, wherein categorizing at least one of said one or more 
event groups includes: 

a. when said change in delay does not exceed said threshold, said preceding interval 
does not contain a delay impairment, and said level of short term delay variation 
has increased, categorizing said event group as said local area network 
congestion. 

22. A method as defined in Claim 7, wherein determining the level of one or more 
impairments includes: 

a. determining the delay of a first packet; 

b. determining the delay of a subsequent packet; and 

c. subtracting the delay of said subsequent packet from the delay of said first packet. 

23. A method as defined in Claim 22, wherein determining the level of one or more 
impairments further includes computing an average of said subtracted value over a short 
period of time. 

24. A method as defined in Claim 22, wherein said one or more problem signatures includes: 

a. a high value of short term delay variation without an increase in delay; 

b. an increase in delay accompanied by an increase in short term delay variation 
followed by a decrease in delay; or 

c. an increase or decrease in delay accompanied by a substantially constant level of 
short term delay variation. 

25. A method as defined in Claim 22, wherein comparing said one or more event groups with 
one or more problem signatures includes: 

a. comparing a change in delay during an interval with a threshold; 

b. determining the level of said short term delay variation during said interval; and 

c. determining whether a preceding interval contains a delay impairment. 
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26. A method as defined in Claim 25 , wherein categorizing at least one of said one or more 
event groups includes: 

a. when said change in delay exceeds said threshold and said preceding interval 
contains said delay impairment, categorizing said event group as said access link 
congestion. 

27. A method as defined in Claim 25, wherein categorizing at least one of said one or more 
event groups includes: 

a. when said change in delay does not exceed said threshold, said preceding interval 
contains a delay impairment, and said level of short term delay variation is low, 
categorizing said event group as said route change. 

28. A method as defined in Claim 25, wherein categorizing at least one of said one or more 
event groups includes: 

a. when said change in delay does not exceed said threshold, said preceding interval 
does not contain a delay impairment, and said level of short term delay variation 
has increased, categorizing said event group as said local area network 
congestion. 

29. A method as defined in Claim 7, wherein determining the level of one or more 
impairments includes: 

a. identifying a first packet having a minimum delay, 

b. subtracting the delay of a second packet from the delay of said packet, 

c. dividing said subtracted value by the time interval between said first and second 
packets to estimate the rate of change of clock speed; and 

d. incorporating said estimated rate of change of clock speed into an average rate of 
change if said estimated rate of change of clock speed exceeds a threshold. 

30. A method as defined in Claim 7, wherein determining the level of one or more 
impairments includes calculating the number of packets lost as a percentage of the sum of 
packets lost plus packets received. 
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31. A method as defined in Claim 7, wherein determining the level of one or more 
impairments includes determining the number of packets received out of sequence as a 
percentage of total number of packets received. 

32. A method as defined in Claim 7, wherein said one or more problem signatures includes: 

a. a high value of short term delay variation without an increase in delay; 

b. an increase in delay accompanied by an increase in short term delay variation 
followed by a decrease in delay; or 

c. an increase or decrease in delay accompanied by a substantially constant level of 
short term delay variation. 

33. A method as defined in Claim 32, further comprising the steps of: 

a. determining the source of more than one call; 

b. grouping said more than one calls into one or more call groups based on the 
source of said more than one calls; 

c. for each call group determining the number of calls having said network problem; 
and 

d. estimating the location of said network problem based on the number of calls 
having said network problem. 

34. A method as defined in Claim 33, wherein determining the source of more than one call 
includes determining the source internet protocol address of said more than one call. 

35. A method as defined in Claim 33, wherein estimating the location of said network 
problem includes: 

a. determining the percentage of calls within said call group having said network 
problem; and 

b. estimating that the location of said network problem is equal to the source 
associated with said call group if the percentage of calls is high. 
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36. A method as defined in Claim 7, wherein comparing said one or more event groups with 
one or more problem signatures includes: 

a. comparing a change in delay during an interval with a threshold; 

b. determining the level of said short term delay variation during said interval; and 

c. determining whether a preceding interval contains a delay impairment. 

37. A method as defined in Claim 36, wherein categorizing at least one of said one or more 
event groups includes: 

a. when said change in delay exceeds said threshold and said preceding interval 
contains said delay impairment, categorizing said event group as said access link 
congestion. 

38. A method as defined in Claim 36, wherein categorizing at least one of said one or more 
event groups includes: 

a. when said change in delay does not exceed said threshold, said preceding interval 
contains a delay impairment, and said level of short term delay variation is low, 
categorizing said event group as said route change. 

39. A method as defined in Claim 36, wherein categorizing at least one of said one or more 
event groups includes: 

a. when said change in delay does not exceed said threshold, said preceding interval 
does not contain a delay impairment, and said level of short term delay variation 
has increased, categorizing said event group as said local area network 
congestion. 
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